1 



10/528075 

DTlSRec^dPCT/PTO J 7 MAR 2005 



SPECIFICATION 

TITLE OF THE INVENTION 

Quantum key distribution method and communication apparatus 

5 

TECHNICAL FIELD 

The present invention relates to a quantum key distribution 
method with which it is possible to create a highly-secured common key, 
and particularly to the quantum key distribution method with which it is 
10 possible correct data error by an error correction code, and to a 

communication apparatus that can realize the quantum key distribution. 

BACKGROUND ART 

A conventional quantum cryptosystem is described below. 

15 Recently, optical communications, which allow high-speed, 

large-capacity communication, have been widely used. In such an 
optical communication system, the communication is performed by 
turning a light beam on and off. When the light beam is turned on, a 
large quantity of photons are transmitted, so that such optical 

20 communication system does not directly produce the quantum effect. 

On the other hand, in the quantum cryptosystem, the photon is 
used as a communication medium, and information of one bit is 
transmitted by one photon so that the quantum effect such as the - 
uncertainty principle is generated. If a person who wants to tap the 

25 communication (hereinafter, "interceptor") randomly selects a base to 
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measure the photon without knowing a quantum state such as a phase, 
the quantum state is changes. Therefore, on a receiver side, it is 
possible to recognize whether transmission data is intercepted by 
confirming the change in quantum state of the photon. 
5 Fig. 9 is an overview of a conventional quantum key distribution 

utilizing polarization. For example, a measuring apparatus, which can 
identify the light polarized in a horizontal direction from the light 
polarized in a vertical direction, correctly identifies the light polarized in 
the horizontal direction (0°) on a quantum communication path from the 

10 light polarized in the vertical direction (90"^) on the quantum 

communication path. On the other hand, another measuring apparatus, 
which can identify the light polarized in an oblique direction (45°, 135°), 
correctly identifies the light polarized in the oblique direction of 45° on a 
quantum communication path from the light polarized in the oblique 

15 . direction of 135° on the quantum communication path. 

As described above, each measuring apparatus can correctly 
recognize the light polarized in the specified direction. However, when 
the light polarized in the oblique direction is measured with the 
measuring apparatus that can identify the light polarized in the 

20 horizontal direction from the light polarized in the vertical direction, the 
apparatus recognizes the light polarized in the horizontal direction (0°) 
and the light polarized in the vertical direction (90°) with the probability 
of 50% respectively. Namely, when a measuring apparatus that does 
not match the identifiable polarized direction is used, even if the 

25 measurement result is analyzed, the polarized direction cannot be 
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correctly identified. 

In the quantum key distribution shown in Fig. 9, by utilizing the 
uncertainty (randomness), a person who transmits the data (transmitter) 
and a person who receives the data (receiver) share a key without 
5 being known by the interceptor (Patent Literature 1). The transmitter 
and the receiver can also use a public communication path in addition 
to the quantum communication path. A procedure of sharing the key is 
described. 

The transmitter first generates a random number sequence 
10 (sequence of 1 and 0: transmission data) and randomly chooses a 
transmission code (+: the code corresponding to the measuring 
apparatus that can identify the light polarized in the horizontal direction 
from the light polarized in the vertical direction, and x: the code 
corresponding to the measuring apparatus that can identify the light 
15 polarized in the oblique direction). The combination of the random 
number sequence and the transmission code can automatically set the 
polarized direction of the transmitted light. In this case, the light 
polarized in the horizontal direction by the combination of 0 and +, the 
light polarized in the vertical direction by the combination of 1 and +, 
20 the light polarized in the 45° direction by the combination of 0 and x, 
and the light polarized in the 135° direction by the combination of 1 and 
X are transmitted to the quantum communication path (transmission 
signal). 

The receiver randomly chooses a reception code (+: the code 
25 corresponding to the measuring apparatus that can identify the light 
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polarized in the horizontal direction from the light polarized in the 
vertical direction, and x: the code corresponding to the nneasuring 
apparatus that can identify the light polarized in the oblique direction) 
and measures the light on the quantum communication path (reception 
5 signal). The receiver obtains reception data by the combination of the 
reception code and the reception signal. In this case, 0 is obtained as 
the reception data by the combination of the light polarized in the 
horizontal direction and +, 1 is obtained as the reception data by the 
combination of the light polarized in the vertical direction and +, 0 is 

10 obtained as the reception data by the combination of the light polarized 
in the 45° direction and x, and 0 is obtained as the reception data by 
the combination of the light polarized in the 135° direction and x. 

The receiver then transmits the reception code to the transmitter 
through the public communication path in order to check whether the 

15 receiver has performed a measurement with an appropriate measuring 
apparatus. Having received the reception code, the transmitter checks 
whether the measurement of the receiver has been performed with an 
appropriate measuring apparatus. The transmitter transmits the result 
to the receiver through the public communication path. 

20 The receiver then saves (keeps behind) only the reception data 

corresponding to the reception signal which is received with the 
appropriate measuring apparatus, and discards other pieces of the 
reception data. At this point, the transmitter and the receiver can 
securely share the saved reception data. 

25 The transmitter and the receiver then transmit the 
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predetermined number of pieces of data selected from the common 
data to each other through the public communication path. The 
transmitter and the receiver confirm whether the received data 
corresponds to the data owned by oneself. For example, when even 
5 one piece of the confirmed data does not correspond to the data owned 
by the transmitter or the receiver, judging that the interceptor is present, 
they discard the common data and perform the process of sharing the 
key again from the start. On the other hand, when the confirmed data 
completely corresponds to the data owned by the transmitter or the 
10 receiver, judging that there is no interceptor, the transmitter and the 
receiver discard the data used for the confirmation, and the saved 
common data becomes the common key for the transmitter and the 
receiver. 

Application of the conventional quantum key distribution method 
15 . includes the quantum key distribution method that can correct data 
error on a transmission path. 

In the method, in order to detect the data error, the transmitter 
divides the transmission data into a plurality of blocks and transmits 
parity in each block onto the public communication path. The receiver 
20 compares the parity in each block received through the public 

communication path, to the parity of the corresponding block in the 
reception data and checks the data error. When a different parity is 
present, the receiver transmits a reply of the information indicating 
which parity of the block is different onto the public communication path. 
25 The transmitter further divides the appropriate block into a first half 
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block. and a second half block and transnnits, for example, the first half 
parity onto the public communication path (binary search). The 
transmitter and the receiver then specify a position of an error bit by 
repeating the binary search, and the receiver finally corrects the 
5 specified bit. 

Assuming that it is determined that a parity is correct due to 
even number of errors even if an error is present in the data, the 
transmitter randomly permutates the transmission data (random 
permutation) to divide the transmission data into a plurality of blocks 

10 and performs the error correction processing by the binary search again. 
All the data errors are corrected by repeatedly executing the error 
correction processing by the random permutation. 

Patent Literature 1: Bennett. C. H. and Brassard, G.: Quantum 
Cryptography: Public Key Distribution and Coin Tossing, In Proceedings 

15 of IEEE Conference on Computers, System and Signal Processing, 
Bangalore, India, pp. 175-179 (DEC. 1984). 

Patent Literature 2: Brassard, G. and Salvail, L. 1993 
Secret-Key Reconciliation by Public Discussion, In Advances in 
Cryptology - EUROCRYPT '93, Lecture Notes in Computer Science 765, 

20 410-423. 

In the conventional quantum key distribution shown in Fig. 9, 
hovyever, an error communication path is not considered. When an 
error is present, the common data (common key) is discarded because 
an intercepting action is presumed to be present. Therefore, there is a 
25 problem that creation efficiency of the common key is correspondingly 
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affected in some transmission paths. 

In the quantum key distribution method that can correct the data 
error on the transmission path, huge number of exchanges of the parity 
is generated for specifying the error bit, and the error correction 
5 processing is also performed in a predetermined times by the random 
permutation. Therefore, there is a problem that a long period of time is 
required for the error correction processing. 

It is an object of the present invention to provide a quantum l<ey 
distribution method that can create a highly-secured common key while 
10 correcting data error on a transmission path by an error correction code 
having remarkably high characteristics. 

DISCLOSURE OF THE INVENTION 

A quantum key distribution nriethod according to the present 

15 invention is employed on a quantum cryptosystem including a first 
communication apparatus that transmits photons onto a quantum 
communication path and a second communication apparatus that 
measures the photons. The method includes, for example, a check 
matrix creation step of each of the first communication apparatus and 

20 the second communication apparatus creating the same parity check 
matrices H(nxk); a random number generation step of the first 
communication apparatus generating a random number sequence 
(transmission data) and randomly determining a predetermined 
transmission code (base) by the first communication apparatus, and the 

25 second communication apparatus randomly determining a 
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predetermined reception code (base); a photon transmission step of the 
first communication apparatus transmitting a photon onto the quantum 
communication path while the photon is in a quantum state specified by 
a combination of the transmission data and the transmission code; a 
5 photon reception step of the second communication apparatus 

measuring the photon transmitted on the quantum communication path 
to obtain reception data specified by the combination of the reception 
code and measurement result; a data deletion step of each of the first 
communication apparatus and the second communication apparatus 

10 deciding whether the measuring has been performed with an 

appropriate measuring apparatus, saving the reception data of n bits if 
the measuring has been performed with the appropriate measuring 
apparatus and transmission data that corresponds to the reception data, 
and discarding other pieces of the data; an error correction information 

15 notification step of the first communication apparatus notifying the 

second communication apparatus through a publip communication path 
of error correction information of k bits based on the parity check matrix 
H and the transmission data of n bits; an error correction step of the 
second communication apparatus correcting the error of the reception 

20 data based on the parity check matrix H, the reception data of n bits, 
and the error correction information; and a cryptographic key creation 
step of each of the first communication apparatus and the second 
communication apparatus discarding a part (k) of pieces of the common 
information (n) after correction according to public error correction 

25 information, creating a cryptographic key using information that has 
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remained after discarding, and setting the cryptographic key as a 
common key which is shared between apparatuses. 

According to the invention, the data error of the common 
information is corrected by a deterministic and stable-characteristics 
5 parity check matrix for "Irregular-LDPC code", and a part of the 
common information is discarded depending on the public error 
correction information. 

BRIEF DESCRIPTION OF THE DRAWINGS 

10 Fig. 1 depicts a configuration of a quantum cryptosystem 

according to a first embodiment of the invention; Figs. 2A and 2B are 
flowcharts of a process procedure for the quantum key distribution 
according to the first embodiment; Fig. 3 is a flowchart of forming 
"Irregular-LDPC code" based on finite affine geometry; Fig. 4 depicts a 

15 matrix of finite affine geometry code AG (2, 2^); Fig. 5 depicts a final 
weight distribution of column X{y\) and a final weight distribution of row 
Pui Fig. 6 depicts a division procedure performed by a Latin square 
matrix of a random sequence; Fig. 7 depicts a configuration of a 
quantum cryptosystem according to a second embodiment of the 

20 invention; Fig. 8 is a flowchart of a quantum key distribution of the 
second embodiment of the invention; and Fig. 9 is an overview of a 
conventional quantum key distribution. 

BEST MODE FOR CARRYING OUT THE INVENTION 
25 Exemplary embodiments of a quantum key distribution method 
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according to the present invention are described with reference to the 
accompanying drawings. It should be noted that the invention is not 
limited to the exemplary embodiments. Although a quantum key 
distribution utilizing a polarized light is described below as an example, 
5 the invention can be also applied to the quantum key distribution 

utilizing a phase, the quantum key distribution utilizing a frequency, and 
the like, and the invention does not particularly limit what quantum state 
is utilized. 

10 First Embodiment 

The quantum key distribution is a key distribution method, which 
is security-guaranteed regardless of computational ability of 
interceptors. However, for example, in order to create a common key 
more efficiently, it is necessary to remove the data error generated 

15 when the data passes through the transmission path. Therefore,, the 
quantum key distribution which performs the error correction by a 
Low-Density Parity-Check (LDPC) code is described in this embodiment. 
It is known that the LDPC code has remarkably high characteristics. 

Fig. 1 depicts a configuration of the communication apparatus 

20 (transmission device and receiving device) in the quantum cryptosystem 
according to the first embodiment of the invention. The quantum 
cryptosystem includes the communication apparatus on the 
transmission side having a function of transmitting information ma and 
the communication apparatus on the reception side having the function 

25 of receiving information ma which is affected by a noise or the like on 
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the transmission path, i.e. information mb. 

The communication apparatus on the transmission side includes 
a cryptographic key creation unit 1 and a communication unit 2. The 
cryptographic key creation unit 1 transmits the information ma through 
5 the quantum communication path, transmits a syndrome Sa through the 
public communication path, and creates a cryptographic key (common 
key with the reception side) based on the information ma and the 
syndrome Sa- In the communication unit 2, an encryption unit 21 
encrypts the data based on the cryptographic key and a transmission 

10 and receiving unit 22 exchanges the data through the public 

communication path. The communication apparatus on the reception 
side includes a cryptographic key creation unit 3 and a communication 
unit 4. The cryptographic key creation unit 3 receives the information . 
mb through the quantum communication path, receives the syndrome Sa 

15 through the public communication path, and creates the cryptographic 
key (common key with the transmission side) based on the information 
mb and the syndrome Sa. In the communication unit 4, an encryption 
unit 42 encrypts the data based on the cryptographic key and a 
transmission and receiving unit 41 exchanges the data through the 

20 public communication path. 

In the communication apparatus on the transmission side, the 
light polarized in the predetermined direction with a polarization filter 
(see Fig. 9) is transmitted as the information mb transmitted onto the 
quantum communication path to the communication apparatus on the 

25 reception side. On the other hand, in the communication apparatus on 
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the reception side, the light polarized in the horizontal direction (0°) on 
the quantum communication path, the light polarized in the vertical 
direction (90°) on the quantum communication path, the light polarized 
in the oblique direction of 45° on the quantum communication path, and 
5 the light polarized in the oblique direction of 135° on the quantum 

communication path are identified by the measuring apparatus that can 
identify the light polarized in the horizontal direction (0°) from the light 
polarized in the vertical direction (90°) and the measuring apparatus 
that can identify the light polarized in the oblique direction (45°) from 

10 the light polarized in the oblique direction (135°). Each measuring 
apparatus can correctly recognize the light which is polarized in the 
specified direction. However, when the light polarized in the oblique 
direction is measured with the measuring apparatus that can identify 
the light polarized in the horizontal direction (0°) from the light polarized 

15 in the vertical direction (90°), the measuring apparatus recognizes the 
light polarized in the horizontal direction and the light polarized in the 
vertical direction with the probability of 50% respectively. Namely, 
when the measuring apparatus that does not match the identifiable 
polarized direction is used, even if the measurement result is analyzed, 

20 the polarized direction cannot be correctly identified. 

The operation of each communication apparatus in the. quantum 
cryptosystem, i.e., the quantum key distribution according to the 
embodiment is described in detail below. Figs. 2A and 2B are 
flowcharts of a process procedure for the quantum key distribution 

25 according to the first embodiment, particularly Fig. 2A depicts a process 
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procedure performed by the communication apparatus on tlie 
transmission side and Fig. 2B depicts a process procedure performed 
by the communication apparatus on the reception side. 

In the communication apparatus on the transmission side and 
5 the communication apparatus on the reception side, parity check matrix 
creation units 10 and 30 obtain a parity check matrix H(nxk) of a 
specific linear code, a creation matrix G((n-k)xn) satisfying "HG=0" from 
the parity check matrix H, and an inverse matrix G'\nx(n-k)) of the 
creation matrix G, and further obtain the inverse matrix G"^ satisfying 

10 G"^-G=l (unit matrix) (step S1 and step S11). The quantum key 
distribution of an instance that the LDPC code having the excellent 
characteristics extremely close to Shannon limit is used as the specific 
linear code is described in this embodiment. The LDPC code is used 
as the error correction method in this embodiment. This embodiment 

15 is not limited to the LDPC code, and it is also possible to use other 

linear codes such as a turbo code. Further, as long as error correction 
information (syndrome) described later is an error correction protocol 
expressed by a product HmA of a proper matrix H and information mA 
(for example, the error correction protocol corresponding to "the 

20 quantum key distribution which can correct the data error on the 

transmission path" described in the Background art), namely as long as 
the linearity of the error correction information and the linearity of the 
information mA are secured, the matrix H may be used as the specific 
linear code. 

25 A method of forming the LDPC code in the parity check matrix 
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creation unit 10, particularly the method of forming an "Irregular-LDPC 
code" based on affine finite geometry (Details of step SI in Fig. 2) is 
described. The description of the parity check matrix creation unit 30 
is omitted because the operation of the parity check matrix creation unit 
5 30 is identical as the parity check matrix creation unit 10. In this 

embodiment, check matrix creation processing may be configured to be 
performed according to a set parameter by the parity check matrix 
creation unit 10, or the check matrix creation processing may be 
configured to be performed by other control units (such as a computer) 

10 outside the communication apparatus. When the check matrix creation 
processing in this embodiment is performed outside the communication 
apparatus, the already created check matrix is stored in the 
communication apparatus. An instance of the above processing being 
performed by the parity check matrix creation unit 10 is described 

15 below. 

The parity check matrix creation unit 10 selects a finite affine 
geometry code AG(2,2®) which becomes a base of the check matrix for 
"Irregular-LDPC code" (Fig. 3, step S21). In this case, a weight of a 
row and the weight of a column become 2^, respectively. Fig. 4 

20 depicts, for example, the matrix of the finite affine geometry code AG (2, 
2^) (a blank in the matrix indicates 0). 

The parity check matrix creation unit 10 then determines a 
maximum value ri (2<ri<2^) of the weight of the column (step S22). 
The parity check matrix creation unit 10 also determines a coding rate 

25 (1 -syndrome length/key length) (step S22), 
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The parity check matrix creation unit 10 then uses optimization 
of Gaussian approximation and tentatively determines a weight 
distribution of the column X{y\) and a weight distribution of the row pu 
(step S23). A creation function p(x) of the weight distribution of the 
5 row is set to p(x) = pu x""V(1-pu)x''. A weight u is an integer of u>2, 
and Pu indicates a portion of the weight u in the row. 

The parity check matrix creation unit 10 selects the weight of the 
row {u, u+1} which can be formed by dividing the row of the finite affine 
geometry, and determines a division coefficient {bu, bu+i} which 
10 satisfies the following equation (1), where bu and bu+i are a 
non-negative integer (step S24). 

bu+bu+i(u+1)=2" (1) 

Specifically, bu+i is determined from the equation (1) after 
determining bu from: 
15 . 



arg-min 

bu 



uxb„ 



(2) 



The parity check matrix creation unit 10 then determines the 
weight distributions pu' and pu+i' of the row updated by the determined 
20 parameters u, u+1 , bu, and bu+i (by the row division processing 
mentioned above) from (step S25): 
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9u = 



uxb., 



(u + 1)x b 
2' 



(3) 



U+1 



10 
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The parity check matrix creation unit 10 then uses the 
optimization of Gaussian approximation, sets u. u+1, pu', and pu+i' 
determined by the calculation to the fixed parameter, and tentatively 
determines the weight distribution of the column >.(Yi) (step S26). The 
Weight y\ is an integer of yi>2, and X(yi) indicates a portion of the weight 
Yi in the column. The parity check matrix creation unit 10 also deletes 
the weight in which the number of column is not more than 1 (A,(yi)< yi/wt, 
i is a positive integer) from candidates. However, Wt indicates the total 
number of 1 included in AG(2,2^). 

The parity check matrix creation unit 10 then selects a set of a 
weight candidate of the column {yi, y2, ... yi (yi<2^)} which satisfies the 
weight distribution determined above and the following equation (4) 
(step S27). When the weight of the column yi, which does not satisfy 
the following equation (4), is present, it is deleted from the candidates. 



^1.1 ^1,2 
^2.1 ^2,2 



a 



a 



2./ 









Y2 






.Y<. 




2\ 



(4) 



20 



In equation 4, "a" indicates tlie coefficient which becomes a 
non-negative integer to {yi, 72, ••• Yi} for forming the weight of the 
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column 2^, i and j are positive integers, y\ indicates the weight of the 
column, and yi indicates the maximum weight of the column. 

The parity check matrix creation unit 10 then uses the 
optimization of Gaussian approximation, sets u, u+1, pu\ pu+i\ and {yi. 
5 Y2, yi} determined above to the fixed parameter, and determines the 
weight distribution X{y\) and the weight distribution of the row pu (step 
S28). 

The parity checl< matrix creation unit 10 then adjusts the weight 
distribution of the column X{y\) and the weight distribution of the row pu 
10 before the division processing (step S29), Each weight distribution 
after the adjustment is set to a value close to the value determined by 
Gaussian approximation as much as possible. Fig. 5 depicts a final . 
weight distribution of column X{y\) and the final weight distribution of 
row pu. 

15 Finally, the parity check matrix creation unit 10 divides the row 

and the column in the finite affine geometry (step S30) and creates the 
parity check matrix H of nxk. In the division processing of the finite 
affine geometry code in the invention, the finite affine geometry code is 
not regularly divided, but the number of "1" is randomly extracted from 

20 each row or each column (see the specific example of random division 
described later). Any method can be used as the extraction 
processing as long as the randomness is held. 

Specifically, when the row number of "1" in the first row in 
EG(2.2^) is expressed as: Bi(x)={1 32 114 136 149 223 260 382 402 

25 438 467 507 574 579 588 622 634 637 638 676 717 728 790 851 861 
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879 947 954 971 977 979 998}; the number of "1" is randomly extracted 
from Bi(x) , and, for example the first row to the fourth row Rm(n) in the 
matrix after the division become as follows: 

Ri(n)={1 114 574 637 851 879 977 979} 
5 R2(n)={32 136 402 467 588 728 861 971} 

R3(n)={149 260 382 438 579 638 717 998} 

R4(n)={223 507 622 634 676 790 947 954}. 

An example of the random division, i.e. the "division niethod 
using a Latin square matrix of a random sequence" is described in 
10 detail below. When the random division is performed, the random 
sequence is easily and deterministically created. The advantage of 
this method is that the transmission side and the reception side can 
create the same random sequence. The procedure of the division 
method is as follows: 
15 (1) The basic random sequence is prepared. At this point, the finite 
affine geometry AG(2,2^) is used, and the basic random sequence C(i) 
is prepared according to the equation (5) when P is set to a minimum 
prime number satisfying P>2^. 

C(1)=1 

20 C(i+1)=GoxC(i) mod P (5) 

Where i=0, 1, P-2, and Go' is a primitive element of Galois 
field GF(P). The number larger than 2^ is deleted from C(i) so that a 
series length becomes 2^, and C(i) after the deletion is set to the basic 
random sequence. 

25 (2) A skip interval S(j) for reading the basic random sequence C(i) at 
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a constant interval is defined as: 

Sa)=j j=1.2. •-, 2' (6) 

(3) A permutation pattern LBj(i) is prepared by: 

LBj(i)=((Sa)xi) mod P)+1 
5 j=1,2,-,2' 

i=1. 2, P-1 (7) 
The number larger than 2® is deleted from LBj(i). 

(4) A jth Latin square matrix Ljp(i} defined by q columns and i rows is 
calculated by: 

10 Ljq(i)=LBj(((q+i-2) mod 2')+1) 

j=1. 2. •.. 2^ 
i=1. 2. 2* 

q=1. 2. • 2" (8) 

(5) The column and the row are divided according to the Latin square 
15 matrix Ljp(i). In the division of the column, go, gi, .., gn-i is set to a 

column vector of the parity check matrix H, and gc'(k) is set to kth "1" in 
the column of gc (c=0, 1 , .... n-1). A set of positions of "1" in gc is set 
to Gc (see equation (9)). 

Gc={gc'(k), k=1. 2. ••. 2*} (9) 
20 For example, the row number of "1 " in the column of c=1 -st of AG(2, 2^) 
becomes Gi={1 3 8 20 23 24 34 58}; When the c-th column vector Is 
expressed by gc'(k), the c-th column vector can be expressed by: 
gc'(1)=((c-1)+1)mod(22*-1) 
gc'(2)=(gc'(1)+2)mod(22«-1) 
25 gc'(3)=(gc'(2)+5)mod(22^-1) 
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gc'(4)=(gc'(3)+12)mod(2"-1) 
gc'(5)=(gc*(4)+3)mod(22^-1) 
gc'(6)=(gc'(5)+1)mod(22^-1) 
gc'(7)=(gc'(6)+1 0)mod(22*-1 ) 
gc'(8)=(gc'(7)+24)mod(2'^-1 ) 



(10.) 



At this point, each column gc of the parity check nnatrix H is 
divided into the new column Qc.e based on a degree and the coefficient 
of the column satisfying the equation (4). gc.e'(0 is set to "1" of the r-th 
row in the new column gc.e (see equation (11)). 



An edge which is divided according to the following equation 
(12) is selected by the Latin square matrix group. Where at.i, at;2, ■ •-, 

at.i and y^. 72 yi are the coefficient and the degree which satisfy the 

equation (4) respectively, and t indicates the row number of a 
coefficient matrix. When the column number of the finite affine plane 
divided by the equation of the tth row is set to nt and the maximum 
value of the row number of the coefficient matrix is set to tm, t can be 
expressed by the following equation (13). 



Gc.e={gc.e'(r), r=1, 2, ••} 



(11) 



g'c,e(r) = g'c(Lj,<,(i)) 
j = c/2" 

q = ((c-1)mod2') + 1 



(12) 



e m-1 



i = r + £ min(a, max(o, e - 1 - ^a,„ )) • y, 
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'l(1^c^ni) 
2(ni +1^0^11, + Hj) 
t i (13) 

trn-1 tm 

The division processing explained in items (1) to (4) is described 
below with a specific example. For example, the row number of "1" in 
the column of c=1-st of AG(2, 2^) is defined as Gi6={10 16 18 23 35 38 
39 49}. Fig. 6 depicts a division procedure performed by the Latin 
square matrix of the random sequence. When the procedure (5) is 
performed by the result of the Latin square matrix, "1" in the new 
column gi6,e can be expressed by the following equation (14). 

gi6,i'(i)=gi6'(L2.8(i))=gi6'(3)=i8 

gi6.i'(2)=gi8'(L2.8(2))=gi6'(2)=16 
gi6.2"(i )=gi6"(L2.8(3))=gi6'(8)=49 
gi6.2'(2)=gi6'(L2.8(4))=gi6'(7)=39 
gi6.3'(1)=gi6'(L2.8(5))=gi6'(6)=38 
gi6.3'(2)=gi6'(L2.8(6))=gi6'(1)=10 
gi6.4'(1)=gi6'(L2.8(7))=gi6'(4)=23 

gi6.4'(2)=gi6'(L2.e(8))=gi6'(5)=35 (14) 

As a result, the 16th column is> divided as follows: 

Gi6.i={18 16} 

Gi6.2={49 39} 

Gi6.3={38 10} 

Gi6.4={23 35} 
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As described above, the deterministic, stable-characteristics 
check matrix H(nxk) for the "Irregular-LDPC code" can be created by 
performing the method of forming the "Irregular-LDPC code" based on 
the affine finite geometry (Fig. 2, step S1). 
5 After the parity check matrix H and the creation matrix G and G"'' 

(G*^ G=I: unit matrix) are created in the above manner, in the 
communication apparatus on the transmission side, a random number 
generation unit 11. generates the random number sequence (sequence 
of 1 and 0: transmission data) and randomly determines the 

10 transmission code (+: the code corresponding to the measuring 

apparatus that can identify the light polarized in the horizontal direction 
from the light polarized in the vertical direction, x: the code 
corresponding to the measuring apparatus that can identify the light 
polarized in the oblique direction) (step S2). On the other hand, in the 

15 communication apparatus on the reception side, a random number 
generation unit 31 randomly determines a reception code (+: the code 
corresponding to the measuring apparatus that can identify the light 
polarized in the horizontal direction from the light polarized in the 
vertical direction, and x: the code corresponding to the measuring 

20 apparatus that can identify the light polarized in the oblique direction) 
(step SI 2). 

In the communication apparatus on the transmission side, a 
photon creation unit 12 transmits the photon in the polarized direction 
automatically determined by the combination of the random number 
25 sequence and the transmission code (step S3). For example, the light 
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polarized in the horizontal direction by the combination of 0 and +. the 
light polarized in the vertical direction by the connbination of 1 and +, 
the light polarized in the 45° direction by the combination of 0 and x, 
and the light polarized in the 135° direction by the combination of 1 and 
5 X are transmitted to the quantum communication path respectively 
(transmission signal). 

In the communication apparatus on the reception side, a photon 
receiving unit 32 that has received the light signal generated from the 
photon creation unit 12 measures the light on the quantum 

10 communication channel (reception signal). The photon receiving unit 
32 obtains the reception data automatically determined by the 
combination of the reception code and the reception signal (step SI 3). 
In this case, 0 is obtained as the reception data by the combination of 
the light polarized in the horizontal direction and +, 1 is obtained as the 

15 reception data by the combination of the light polarized in the vertical 
direction and +, 0 is obtained as the reception data by the combination 
of the light polarized in the 45° direction and x, and 0 is obtained as the 
reception data by the combination of the light polarized in the 135° 
direction and x respectively. 

20 In the communication apparatus on the reception side, the 

random number generation unit 31 transmits the reception code to the 
communication apparatus on the transmission side through the public 
communication path in order to check whether the measurement has 
been performed with an appropriate measuring apparatus (step SI 3). 

25 When the communication apparatus on the transmission side receives 
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the reception code, the communication apparatus on the transmission 
side checks whether the measurement has been performed with an 
appropriate measuring apparatus. The transmitter transmits the result 
to the communication apparatus on the reception side through the 
5 public communication path (step S3). The communication apparatus 
on the reception side and the communication apparatus on the 
transmission side save only the data corresponding to the reception 
signal which has received with the appropriate measuring apparatus 
and discard other pieces of the reception data (step S3 and step S13). 

10 The saved data is then stored in the memory or the like, and the n bits 
of the data are sequentially read out from the front end of the data to 
create transmission data mA and reception data me (me is mA which is 
affected by the noise and the like on the transmission path). Namely, 
the next n bits are read out after each completion of the common key 

15 creation processing, and the transmission data mA and the reception 
data me are created in each case. . In this embodiment, the position of 
the bit corresponding to the reception signal received by the 
appropriate measuring apparatus can be shared between the 
communication apparatus on the transmission side and the 

20 communication apparatus on the reception side. 

In the communication apparatus on the transmission side, a 
syndrome creation unit 14 calculates syndrome SA=HmA of mA by the 
parity check matrix H(nxk) and the transmission data mA and notifies a 
public communication path communication unit 13 and the 

25 communication apparatus on the reception side of the result through the 
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public communication path (step S4). At this step, there is a possibility 
that the syndrome Sa of mA (information of k bits) is known by the 
interceptor On the other hand, in the communication apparatus on the 
reception side, public communication path communication unit 34 
5 receives the syndrome Sa of mA and notifies a syndrome decoding unit 
33 of the syndrome Sa of mA (step SI 4). 

The syndrome decoding unit 33 calculates syndrome SB=HmB of 
me by the parity check matrix H and the transmission data me and 
further calculates syndrome S=Sa+Sb by the syndrome Sa of mA and the 
10 syndrome Sa of ms (step S15). The syndrome decoding unit 33 

estimates transmission data mA based on the syndrome S (step S16). 
At this point, it is assumed that mA = mA+e (noise and the like) and the 
syndromes is deformed as shown in the equation (15). "e" is 
accordingly obtained by syndrome decoding, and the transmission data 
15 mA is obtained (step SI 6). of S=Sa+Sb and mA+e indicates 
exclusive OR. 

S=Sa+Sb 
=HmA+HmB 
=H(mA+mB) 
20 =H(mA+mA+e) 

=He (15) 
Finally, In the communication apparatus on the reception side, a 
common key creation unit 35 discards a part of pieces of the common 
information (mA) according to the public error correction information (the 
25 information of k bits having a possibility of the intercept: Sa) and 

1 
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creates the. cryptographic key r including the amount of information of 
n-k bits (step SI 7). Namely, the common key creation unit 35 creates 
the cryptographic key r from the following equation (16) by the 
G'\nx(n-k)) which is calculated in advance. The communication 
5 apparatus on the reception side shares the cryptographic key r with the 
communication apparatus on the transmission side. 

r=G-^mA (16) 
On the other hand, in the communication apparatus on the 
transmission side, a common key creation unit 15 discards a part of 

10 pieces of the common information (mA) according to the public error 
correctionjnformation (the information of k bits having a possibility of 
the intercept: Sa) and creates the cryptographic key r including the 
amount of information of n-k bits (step S5). Namely, the common key 
creation unit 15 creates the cryptographic key r from the following 

15 equation (16) by the G'^(nx(n-k)) which is calculated in advance (step 
S5). The communication apparatus on the transmission side shares 
the cryptographic key r with the communication apparatus on the 
reception side. 

As described above, in this embodiment, the data error of the 
20. common information is corrected by the deterministic, 

stable-characteristics parity check matrix H(nxk) for the "Irregular-LDPC 
code" and a part of pieces of the common information is discarded 
according to the public error correction information. Accordingly, the 
huge number of exchanges of the parity for specifying and correcting 
25 the error bit is avoided and error correction control is performed only by 
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transmitting the error correction infornnation, so that the time for the 
error correction processing is considerably reduced. Further, since a 
part of pieces of the common information is discarded according to the 
public error correction information, the highly-secured common key can 
5 be created. 

In this embodiment, the inverse matrix G"\nx(n-k)) which 
becomes G"^ G=I (unit matrix) is created from the creation matrix 
G(nx(n-k)) satisfying HG=0, a part (k) of pieces of the common 
information (n) is discarded by the inverse matrix G'\ and the 

10 cryptographic key r including the amount of information of n-k bits. 

However, the invention is not limited to the embodiment, and a part of 
pieces of the common information (n) may be discarded and the 
cryptographic key r including the amount of information of m bits 
(m<n-k). Specifically, a mapping F( ) which maps an n-dimensionai 

15 vector to an m-dimensional vector is assumed. In order to secure the 
common key, it is necessary that F( ) satisfies the condition that "the 
number of elements of a reverse image (F G)"\v) in a composition 
mapping F*G of the mapping F and the creation matrix G is independent 
of an arbitrary m-dimensional vector v and is constant(2""*^"'^)." At this 

20 point, the cryptographic key r becomes r=F(mA). 

Second Embodiment 

In the second embodiment, confidentiality of the cryptographic 
key r according to the first embodiment is further enhanced. 
25 Fig. 7 depicts a configuration of the quantum cryptosystem 
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according to the second embodiment of the invention. Like parts of the 
configuration as the first embodiment are designated by like reference 
numerals, and the description of like constituents is omitted. In order 
to enhance the confidentiality against the information intercepted on the 
5 quantum communication path, it is necessary that the information of the 
bits intercepted is compressed by a hash function. However, the hash 
function has some positions where interceptions can be easily made, 
depending on characteristics of the hash function. Therefore, this 
embodiment deals with intercepts of the hash function by randomly 

10 rearranging the position. 

Fig. 8 is a flowchart of the quantum key distribution of the 
second embodiment, particularly depicts the processing of the 
communication apparatus on the transmission side. In the 
communication apparatus on the transmission side, a random 

15 permutation unit 16 creates a nonsingular random matrix R((n-k)x(n-k)), 
notifies the common key creation unit 15 of R, and further notifies the 
common key creation unit 35 in the communication on the transmission 
side of R through the public communication path (step S6). In Figs. 7 
and 8. although the random matrix is created and transmitted in the 

20 communication apparatus on the transmission side, as an example, it is 
also possible that the processing is performed in the communication 
apparatus on the reception side. 

In the communication apparatus on the transmission side, the 
common key creation unit 15 discards a part of pieces of the common 

25 information (mA) according to the public error correction information (the 
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information of k bits having a possibility of the intercept: Sa), enhances 
the confidentiality by the received random matrix R, and creates the 
cryptographic key r including the amount of information of n-k bits (step 
S5). Namely, the common key creation unit 15 creates the 
5 cryptographic key r from the following equation (17) by the received 
random matrix R((n-k)x(n-k)) and the G"\nx(n-k)) which is calculated in 
advance (step S5). The communication apparatus on the transmission 
side shares the cryptographic key r with the communication apparatus 
on the reception side. 

10 r=RG'^mA (17) 

On the other hand, in the communication apparatus on the 
reception side, the common key creation unit 35 also discards a part of 
pieces of the common information (mA) according to the public error 
correction information (the information of k bits having a possibility of 

15 the intercept: Sa), enhances the confidentiality by the received random 
matrix R, and creates the cryptographic key r including the amount of 
information of n-k bits (step S17). Namely, the common key creation 
unit 15 creates the cryptographic key r from the following equation (17) 
by the received random matrix R((n-k)x(n-k)) and the G"\nx(n-k)) which 

20 is calculated in advance (step SI 7). The communication apparatus on 
the reception side sets the cryptographic key r to the common key 
which is shared with the communication apparatus on the transmission 
side. 

As described above, in this embodiment, the data error of the 
25 common information is corrected by the deterministic, 
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stable-characteristics parity check matrix H(nxk) for the "Irregular-LDPC 
code," a part of pieces of the common information is discarded 
according to the public error correction information, and the common 
information is rearranged by the nonsingular random matrix. Therefore, 
5 the huge number of exchanges of the parity for specifying and 
correcting the error bit is avoided and error correction control is 
performed only by transmitting the error correction information, so that 
the time for the error correction processing is considerably reduced. 
Since a part of pieces of the common information is discarded 
10 according to the public error correction information, the highly-secured 
common key can be created. Further, since the common information is 
rearranged by the nonsingular random matrix, the confidentiality can be 
enhanced. 

In this embodiment, similarly to the first embodiment, it is also 
15 possible that a part of pieces of the common information (n) is 
discarded and the cryptographic key r including the amount of 
information of m bits (m<n-k). In this case, the common key becomes 
r=RF(mA). 

20 Third Embodiment 

In the first embodiment, a part of pieces of the common 
information is discarded by the inverse matrix G"'' of the creation matrix 
G. On the contrary, in the third embodiment, a part of pieces of the 
common information is discarded without using the inverse matrix G"^ of 

25 the creation matrix by the characteristics of the parity check matrix H. 
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The configuration of this embodiment is similar to the first embodiment 
shown in Fig. 1 . 

The quantum key distribution according to the third embodiment 
is described below. Only the processing different from the processing 
5 in Fig. 2 is described. 

In the communication apparatus on the transmission side and 
the communication apparatus on the reception side, the parity check 
matrix creation units 10 and 30 determine the parity check matrix 
H(nxk) of the specific linear code (step SI and step S11). The method 

10 of forming the "Irreguiar-LDPC code" based on the affine finite 

geometry (Details of step SI in Fig. 2) is similar to the first embodiment 
shown in Fig. 3. 

After step S2 to step S4 are performed in the same procedure 
as the first embodiment, in the communication apparatus on the 

15 reception side, the common key creation unit 35 discards a part of 
pieces of the common information (mA) according to the public error 
correction information (the information of k bits having a possibility of 
the intercept: Sa) and creates the cryptographic key r including the 
amount of information of n-k bits (step SI 7). Specifically, the common 

20 key creation unit 35 performs the random permutation to the column of 
the parity check matrix created in step S11 . The common key creation 
unit 35 then exchanges the information concerning the bit discarded 
with the communication apparatus on the transmission side through the 
public communication path. In this case, the common key creation unit 

25 35 selects the specific "1" from the first column of the original finite 
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affine geometry AG(2,2^) and exchanges the position of "1" with the 
communication apparatus on the transmission side through the public 
communication path. 

The common key creation unit 35 then specifies the position 
5 after the division corresponding to the "1 " and the position after the 
division corresponding to the "1" in each cyclically-shifted column from 
. the parity check matrix after the random permutation, discards the bit in 
the common information mA corresponding to the specified positions, 
and makes the saved data the cryptographic key r. The 

10 communication apparatus on the reception side sets the cryptographic 
key r to the common key which is shared with the communication 
apparatus on the transmission side. 

On the other hand, in the communication apparatus on the 
transmission side, the common key creation unit 15 discards a part of 

15 pieces of the common information (mA) according to the public error 
correction information (the information of k bits having a possibility of 
the intercept: Sa) and creates the cryptographic key r including the 
amount of information of n-k bits (step S5). Specifically, the common 
key creation unit 15 performs the similar random permutation to the 

20 column of the parity check matrix created in step S1 . The common key 
creation unit 15 then exchanges the information concerning the brt 
discarded with the communication apparatus on the reception side 
through the public communication path. 

The common key creation unit 15 then specifies the position 

25 after the division corresponding to the "1" and the position after the 
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division corresponding to the "1" in each cyclically-shifted column from 
the parity check matrix after the random permutation, discards the bit in 
the common information mA corresponding to the specified positions, 
and makes the saved data the cryptographic key r. The 
5 communication apparatus on the transmission side sets the 
cryptographic key r to the common key which is shared with the 
communication apparatus on the reception side. 

As described above, in the third embodiment, a part of pieces of 
the common information is discarded without using the inverse matrix 

10 G"^ of the creation matrix by the characteristics of the parity check 
matrix H. Accordingly, the same advantage as the first embodiment 
can be obtained, and the complicated creation matrix G and the 
complicated inverse matrix G"^ can be deleted. 

In this embodiment, it is also possible that a part of pieces of the 

15 common information is discarded by the characteristics of the parity 
check matrix H and, similarly to the second embodiment, the common 
information is rearranged by the nonsingular random matrix. Therefore, 
the confidentiality can be enhanced. 

As. described above, according to the present invention, the data 

20 error of the common information is corrected by the deterministic, 

stable-characteristics parity check matrix H(nxk) for the "Irregular-LDPC 
code" and a part of pieces of the common information is discarded 
according to the public error correction information. Accordingly, the 
present invention has the advantage that the huge number of 

25 exchanges of the parity for specifying and correcting the error bit is 
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avoided and error correction control is performed only by transmitting 
the error correction information, so that the time for the error correction 
processing is considerably reduced. Further, the invention has the 
advantage that highly-secured common key can be created because a 
5 part of pieces of the common information is discarded according to the 
public error correction information. 

INDUSTRIAL APPLICABILITY 

As described above, the quantum key distribution method and 
10 the communication apparatus are useful for the quantum cryptosystem 
which uses the photon as the communication medium, particularly 
suitable to the apparatus that creates the highly-secured common key. 



